Repository navigation
chore(deps): update all non-major dependencies - #98
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
|
Important Review skippedBot user detected. To trigger a single review, invoke the
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #98 +/- ##
=======================================
Coverage 84.73% 84.73%
=======================================
Files 10 10
Lines 773 773
Branches 229 228 -1
=======================================
Hits 655 655
Misses 105 105
Partials 13 13 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
October 3, 2026 12:30
d12aa92 to
9a62b1b
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
October 7, 2026 05:16
2cda15a to
7f1a2e1
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
October 9, 2026 08:31
7f1a2e1 to
1e90425
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
October 9, 2026 16:52
1e90425 to
b74c3ae
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
October 13, 2026 14:28
812423e to
2d2faa8
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
October 16, 2026 12:24
2d2faa8 to
f262e87
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
October 23, 2026 00:21
ae16ed9 to
876fd14
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
October 29, 2026 03:54
286bba9 to
8975be6
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
October 30, 2026 11:59
9d8e315 to
02efa5b
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
October 30, 2026 16:22
02efa5b to
e74e149
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
^5.0.4→^5.0.54.0.0-rc.2→4.0.0-rc.4^1.1.3→^1.2.0^1.4.3→^1.4.5^0.72.0→^0.75.0^1.87.0→^1.90.011.26.0→11.28.9^1.2.13→^1.2.15^5.0.4→^5.0.5bump,lockfileUpdate, orrollbackupdates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).Release Notes
vitest-dev/vitest (@vitest/coverage-v8)
v5.0.5Compare Source
🐞 Bug Fixes
fs.denywith api token file - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #11578 (28dc1)--changed- by @sheremet-va in #11583 (14921)datato theimport.meta.hotstub - by @sheremet-va in #11590 (3a828)skipinskipIf, ignoreundefinedoptions - by @sheremet-va in #11591 (d523a)&#​39;failed&#​39;on worker crash - by @AriPerkkio in #11568 (6ae8e)View changes on GitHub
Rich-Harris/magic-string (magic-string)
v1.4.5Compare Source
Bug Fixes
Performance Improvements
v1.4.4Compare Source
Bug Fixes
replace(#367) (aed5675)oxc-project/oxc (oxfmt)
v0.75.0: oxfmt v0.75.0Compare Source
🐛 Bug Fixes
5042019formatter: Keep fill layout for array with comment after [ (#28170) (leaysgur)9d37ff6formatter: Use position-based comment checks for concise arrays (#28169) (leaysgur)016c4a2formatter: Keep a comment before}inside a JSX spread child (#28103) (vidigoat)190bb1eformatter: Keep parens around an instantiation expression ending an operand through any tight parent (#28168) (leaysgur)a5314a1formatter: Keep;beforeinandinstanceofclass members (#28166) (leaysgur)3a56e7cformatter: Keep closing HTML comments at the start of a line (#28064) (Cameron)23d23d6formatter_markdown: Honor range ignore inside directives (#28164) (leaysgur)5f1fd3dformatter: Measure width heuristics by display width (#28098) (leaysgur)a5a52cfformatter: Keep parens around privateinexpressions (#28096) (leaysgur)999496eformatter: Measure a short key by its display width (#28026) (vidigoat)7e9aa44formatter: Keep parens around a looser operand of an instantiation expression (#28025) (vidigoat)6912d1fformatter: Keep an arrow signature that exactly fills the line for any body (#27989) (leaysgur)eb1d9f9formatter_core: Count a flatlinespace infitsonly when text follows (#27987) (leaysgur)⚡ Performance
1ed93afdata_structures: Copy short strings without a memcpy call (#27953) (leaysgur)7948f0bformatter_core: ShrinkFormatElementto 16B (#28012) (leaysgur)788af22formatter: KeepAstNodes on the stack, and only chain links in the arena (#27963) (leaysgur)📚 Documentation
068a8eaformatter: Fix up wording (#28167) (leaysgur)db55461formatter_core: Document text width divergence (#28095) (leaysgur)880d229formatter: Add vitest-test-call to known divergences (#28006) (leaysgur)v0.74.0: oxfmt v0.74.0Compare Source
🐛 Bug Fixes
e236de0formatter_tests: Skip conformance spec calls with non-literal options (#27957) (leaysgur)782ab6elinter: Search string values without UTF-8 conversion (#26716) (Dunqing)a5d8184jsdoc: Parse code spans after quotes in descriptions (#27955) (leaysgur)2645d2cformatter_markdown: Treat link destinations and footnote references as opaque to code span fences (#27948) (leaysgur)4d8195cformatter_yaml: Keep a root plain scalar starting with a document marker verbatim (#27947) (leaysgur)529b057formatter_core: Keep front matter verbatim when body starts with indented delimiter (#27946) (leaysgur)c22a9b2formatter: Treat static block with only empty statements as empty (#27945) (leaysgur)d3ff3f6formatter/jsdoc: Write descriptions as written to not close the comment (#27823) (leaysgur)c4c1727formatter/sort_imports: Keep comments after the last import (#27822) (leaysgur)a64677eformatter: Print JSDoc embedded snippets with LF (#27821) (leaysgur)2c1cc20formatter: Keep comment only Vue bindings as-is (#27820) (leaysgur)1bf236dformatter/sort_imports: Do not use comments as import source (#27819) (leaysgur)52ee29dformatter_yaml: Never start col-0 line with document marker or BOM (#27818) (leaysgur)81c75e7formatter/css: Keep glued css-in-js statement placeholders glued (#27814) (leaysgur)a1ef7f4formatter: Keep typecast parens in same-operator binary and arrow chain (#27812) (leaysgur)de110ceformatter: Keep more parens aroundTSInstantiationExpression(#27811) (leaysgur)8b02e90formatter_json: Reject invalid JSON instead of dropping them (#27785) (leaysgur)6fe4c1bformatter: Treat lone CR in JSX text and argument blank lines (#27780) (leaysgur)5605362oxfmt: Validate editorconfig as like oxfmtrc (#27778) (leaysgur)5b2acb0formatter_core: Report error position releative to CRLF source (#27777) (leaysgur)c78e80eformatter_core: Report parse error positions relative to the BOM-headed source (#27776) (leaysgur)3a980c9formatter_toml: Handle BOM like other languages (#27775) (leaysgur)97c9fc4oxfmt: Handle BOM in config JSON (#27774) (leaysgur)28eb4a7oxfmt: Print trailing newline for--list-different(#27773) (leaysgur)d2bea21formatter: Glue comments to an opener in empty for-head slots and array holes (#27737) (leaysgur)6a95ec1formatter: Keep comment position on holey array (#27730) (leaysgur)54769daformatter: Break after dangling line comment in holey array (#27729) (leaysgur)99077efformatter_json: Reject unary expressions other than signed numbers (#27728) (leaysgur)22cd4cdformatter_json: Handle holey array and comments (#27727) (leaysgur)644ca1cformatter: Do not indent logical chains whose right sides all inline (#27667) (leaysgur)a07a0fbformatter: Wrap comment-only JSX expression container in a group (#27666) (leaysgur)⚡ Performance
e220293formatter: Check only the operator suppression mark inis_quiet(#27952) (leaysgur)e5fdc9cformatter_core: Write into one element stack through a concreteFormatter(#27559) (leaysgur)a342f7eformatter: Skip comment handling for nodes with no comment near them (#27557) (leaysgur)d8ce750formatter: Write string literals with swapped quotes into the arena (#27558) (Yuji Sugiura)1c393c0formatter_core: Skip scanning texts with nothing to rewrite (#27561) (leaysgur)1d3ef10formatter_core: Keep the embedded IR when nothing in it is rewritten (#27673) (leaysgur)📚 Documentation
1325225oxfmt: Update useless comment prefix (#27956) (leaysgur)d0dd140formatter: Note lossy cooked round-trip in template embeds (#27944) (leaysgur)8a3a6c8oxfmt: Update stale notes on the JSDoc string-out channel and fixture origins (#27824) (leaysgur)v0.73.0Compare Source
🚀 Features
a495e82oxfmt: Supportassociationsconfig to specify language over filepath (#27437) (leaysgur)5db28faoxfmt: Support Astro viaprettier-plugin-astro@1.x(#27386) (leaysgur)📚 Documentation
408d87foxfmt: Simplify oxfmtrc docs (#27432) (leaysgur)902e188oxfmt: Update howembeddedLanguageFormattingoption works (#27362) (leaysgur)oxc-project/oxc (oxlint)
v1.90.0Compare Source
🚀 Features
831cdf1oxlint: Require mininum oxlint-tsgolint version v7.0.2005 (#28118) (camc314)d1b00f4linter/typescript: Implement no-unsafe-enum-assignment rule (#28117) (camc314)165c91flinter/typescript/await-thenable: SupportallowMixedPromiseArraysoption (#28116) (camc314)v1.89.0Compare Source
🐛 Bug Fixes
9a424c2oxlint,oxfmt: Correct Node.js TypeScript support range (#27699) (camc314)v1.88.0Compare Source
🚀 Features
3c361a7linter/unicorn/prefer-query-selector: AddallowWithVariablesoption (#27346) (Mikhail Baev)pnpm/pnpm (pnpm)
v11.28.9: pnpm 11.28.9Compare Source
This release fixes a crash on registry responses with too many content encodings (GHSA-xjj6-f33q-929c) and sizes the install worker pool by the container's CPU quota. A repeat
pnpm installnow acts on more setting changes.Patch Changes
Crashes and security
A registry response with too many content encodings can no longer crash pnpm. pnpm now uses undici 7.30.1, which fixes GHSA-xjj6-f33q-929c.
pnpm installnow sizes its worker pool by the CPU quota of the container it runs in, such as a Kubernetes CPU limit, when that quota is smaller than the number of CPUs the container may run on. The defaultworkspaceConcurrencyrespects the quota the same way. On a CI runner with a 4-CPU quota and hundreds of host CPUs, pnpm started hundreds of workers and ran out of memory #17382.Repeat installs and changed settings
A repeat
pnpm installnow acts on a change to these settings. Before, it reported "Already up to date".storeDirorvirtualStoreDir: it recreatesnode_modules.virtualStoreDirMaxLength: it renames the virtual store directories.dangerouslyAllowAllBuildsturned on: it runs the builds it skipped.trustLockfileturned off: it verifies the lockfile.pnpm add,pnpm remove, andpnpm updatenow fail when thenode-linkersetting differs from the one recorded innode_modules. Apnpm installof the whole workspace recreatesnode_moduleswith the newnode-linker, and an install filtered to some projects fails pnpm/tasks#203.An install filtered to some workspace projects now fails if
node_moduleswas installed with a differentnodeLinker,hoistPattern,publicHoistPattern, store, or virtual store. Before, it recreatednode_modulesand left the projects it skipped without their dependencies. Apnpm installof the whole workspace still recreatesnode_modulespnpm/tasks#217.pnpm installnow takes its fast path in a workspace withpatchedDependencieswhen the previous install ran with another major version of pnpm.pnpm installnow relinks the bins of a workspace package when itsbinfield changes, including with--frozen-lockfileand an unchanged lockfile. A filtered install relinks them in the selected projects, and the next install that covers the remaining projects relinks them there #17324.pnpm installnow removes command shims fromnode_modules/.binwhen a workspace dependency renames or removes an entry from itsbinfield pnpm/tasks#211.With
nodeLinker: hoisted, an install that stops partway no longer leaves the next install trusting the packages it was replacing. Before, reverting the change that started the stopped install, such as a patch edit, kept the half-replaced package innode_modules.pnpm runandpnpm execno longer report the dependencies as out of date after a lockfile change whendedupePeersistrue#17322.Resolving dependencies and the lockfile
A package that a plain range and a
<prefix>:specifier both resolve from one registry is now recorded once inpnpm-lock.yamland installed once. The lockfile key names the registry a package resolved from. When that registry declares a prefix, throughprefixinregistriesor throughnamedRegistries, the package is keyed<name>@<prefix>:<version>however its dependency was written: with the prefix, as a plain range its scope routes to that registry, or through the default registry. Before, the plain range was keyed<name>@<version>, so one tarball was installed twice andinstanceofchecks and module singletons broke between the two copies. The same name and version served by two registries still get separate entries. When several prefixes declare one registry, its packages are keyed by the lexicographically smallest prefix.If a scope you route reaches a registry that also declares a prefix, your next
pnpm installre-keys those entries, which shows up as a lockfile diff. Commit it.pnpm install --frozen-lockfileinstalls the lockfile as recorded.pnpm installnow resolves a scope's packages again when the scope is routed to another registry inregistries. Before, the lockfile kept the versions and integrity resolved from the old registry, so the install failed when the new registry did not serve a locked version or served different content. pnpm records in the workspace state which registry each scope routed to, so a fresh clone without that record installs the lockfile as recorded. Changing the default registry resolves nothing again, andpnpm install --frozen-lockfileis unchanged.An optional dependency written with a named-registry prefix, such as
work:^1.0.0, now fails the install when it cannot be resolved but the lockfile already has a matching entry from that registry. Such a dependency was skipped, which removed its entries from the lockfile.With
injectWorkspacePackages: true, aworkspace:dependency written as a relative path, such asworkspace:../lib-a, in a workspace package now resolves from that package's directory #17284.Fixed
pnpm installfailing withERR_PNPM_UNSUPPORTED_PROTOCOLwhen a workspace package injected through a relative path, such asworkspace:../lib, hascatalog:dependencies. Their catalog entries now resolve the way they do for a package injected by name #17280.pnpm installnow applies theserverTyperegistry setting when it updates the lockfile for an override or catalog change without a full resolution. pnpm wrote the tarball URLs of a declared registry into the lockfile in that case.Added the
pnprvalue to theserverTyperegistry setting. pnpm leaves the tarball URLs of a pnpr registry out ofpnpm-lock.yaml.A
registriesentry whoseprefixis__proto__is no longer ignored.Installs delegated to a pnpr server now resolve every prefix declared for a registry URL. A dependency or lockfile entry that used the second of two prefixes for the same registry, such as
zeta:next towork:innamedRegistries, failed on the server pnpm/tasks#204.Registries, proxies, and downloading pnpm
The proxy settings
httpProxy,httpsProxy,noProxy,proxy, andnoproxyset in the globalconfig.yaml, throughPNPM_CONFIG_HTTPS_PROXYand the matching variables, or as--config.httpsProxyon the command line now apply topnpm self-updateand to the download of the pnpm version pinned inpackageManager. Previously, these requests read the proxy only from.npmrcand theHTTPS_PROXYfamily of variables pnpm/tasks#215.When
https-proxyisfalse, pnpm now downloads the pnpm version pinned bypackageManagerthrough the legacyproxysetting, as installs already do. Settingproxytofalsenow also stops that download from using theHTTP_PROXYenvironment variable. The signature check of the pinned pnpm now uses the same proxy and TLS settings as its download pnpm/tasks#193.strictSslandlocalAddressset in the globalconfig.yaml, throughPNPM_CONFIG_STRICT_SSLandPNPM_CONFIG_LOCAL_ADDRESS, or on the command line now apply topnpm self-updateand to the download of the pnpm version pinned inpackageManager. These requests read them from.npmrconly before.--config.localAddressnow reaches them in the camelCase spelling too pnpm/tasks#201.Commands
pnpm audit --ignoreandpnpm audit --ignore-unfixablenow exit with a non-zero code when vulnerabilities at or above the audit level remain after ignoring. Before, these commands always exited with code 0.pnpm audit --fixandpnpm audit --interactivenow fail withERR_PNPM_AUDIT_FIX_WITH_IGNOREwhen combined with--ignoreor--ignore-unfixable. Before, the fix ran and the ignore flags had no effect.pnpm ci --lockfileandpnpm ci --config.lockfile=trueno longer deletepnpm-lock.yaml.pnpm cinow always keeps the lockfile and runs a frozen install from it.pnpm deploynow keeps a deployed symlink to a directory inside the project even if the directory is not among the deployed files, such as a link intonode_modules#17288.pnpm packandpnpm publishagain include the files of apublishConfig.directorythat is reached through a symlink, together with its bundled dependencies #17390.pnpm -r publish --batchnow sendsPUT /-/pnpr/v0/publish, the batch publish endpoint that pnpr serves.pnpm store prunenow keeps the packages that a project still uses when pnpm copied or cloned them intonode_modules. These include patched packages, built packages, and every package installed withpackageImportMethod: copy. Before, the prune removed them, and the next install downloaded them again #7192.pnpm store prunenow keeps the packages of a project that was installed with a different symlinked spelling of the store path. Previously, prune dropped such a project from its list and removed the packages only that project used from the global virtual store.Speed and output
Sped up installs of projects whose local directory dependencies share transitive local directory dependencies. pnpm no longer checks a shared directory again for each direct dependency that reaches it #17374.
Output that fills the terminal, such as
pnpm run --streamscript output, is now written once. Before, every new line also rewrote all the lines already on screen #17387.The warning about unrecognized settings now marks
symlinkedLockfileTargetDirsas a setting of a newer pnpm version.Platinum Sponsors
Gold Sponsors
v11.28.8: pnpm 11.28.8Compare Source
Patch Changes
@pnpm/exebuilds now embed Node.js 26.12.1. The previously embedded Node.js 26.0.0 still trusted the certificate authority intermediates that Node.js distrusted in October 2026, so a standalone pnpm accepted TLS certificates issued under them.Platinum Sponsors
Gold Sponsors
v11.28.7: pnpm 11.28.7Compare Source
This release rejects registry metadata that names a different package than the one requested, applies
trustPolicyto the pnpm version a project pins, and caps unpacked package size withmaxTarballUnpackedSize. It also removes support for registry revisions, fixesverifyDepsBeforeRunafter filtered installs, and finishes commands with their own exit code when a pipe reader exits early.Patch Changes
Security
pnpm now fails with
ERR_PNPM_REGISTRY_NAME_MISMATCHif a registry returns metadata for a package other than the one requested. Before, pnpm installed the package under the name in the metadata, soallowBuildsrules for the requested package did not apply to it.pnpm now applies
trustPolicyto the pnpm version a project pins inpackageManagerordevEngines.packageManager. A pinned version whose trust evidence was downgraded fails the command before pnpm switches to it or records it in the lockfile #16319.minimumReleaseAgeExcludePruneandtrustPolicyExcludePrunenow keep exclusions for resolved configuration dependencies and their transitive dependencies #17142.Added the
maxTarballUnpackedSizesetting.pnpm installfails withERR_PNPM_TARBALL_TOO_LARGEwhen the files of one package unpack to more than this many bytes, 4 GiB by default pnpm/tasks#81.Resolving dependencies
Registry revisions are no longer supported. pnpm now fails with
ERR_PNPM_REGISTRY_REVISIONS_UNSUPPORTEDon registry metadata that selects a revision, on a+rNversion specifier, and on a lockfile entry with arevisionfield.pnpm update --patchesis removed.When
pnpm installresolves a dependency again, it now reuses a version that the install already resolved for the same package, as a fresh install does. Before, it kept the version the lockfile pinned and added a second copy of the package. A locked version still stays when nothing else in the install prefers another version. To pin a transitive dependency on purpose, useoverrides#17084.When another workspace project adds a different version of a package, a project's auto-installed peer on that package now moves to the version a fresh install picks. It used to stay on its locked version while any other project still accepted that version #17058.
An optional peer that pnpm adds to a project now keeps the version the lockfile recorded for that project only while the dependency graph still holds it. Otherwise it follows its provider to a version the graph holds. Before, pnpm kept a higher version that only the lockfile held, which left two copies of the peer #16443.
A package that lists the same dependency in
dependenciesand as an optional peer now gets the peer bound when a project adds a provider for it later. The lockfile now records every peer a package declares, including one its own dependency supplies #17056.pnpm install --prodno longer drops a dependency that a package declares both as an optional peer and as its own dependency, when the package resolved it as its own dependency and a dev dependency provides the same package under another alias.pnpm now measures a
pnpm.overridesentry written as aworkspace:path, such asworkspace:./packages/foo, from the directory holdingpnpm-workspace.yaml. It used to be measured from each package the override rewrote. The install then linked a directory that does not exist, or failed if workspace packages were injected #17010.pnpm installnow removes config dependencies that are no longer declared, including when the entireconfigDependenciessetting is removed. Frozen installs reject a lockfile that still records removed config dependencies.pnpm addnow reads the package name correctly from a tarball URL under a registry URL that has a path, such ashttps://example.com/npm/. Before, the registry path became part of the name, so a scoped package failed withERR_PNPM_INVALID_PACKAGE_NAME.pnpm addno longer warns that a gist dependency was replaced from a different source when the new specifier names the same gist in another form, such asgist:<id>andhttps://gist.github.com/<user>/<id>.With
minimumReleaseAgeset, pnpm now revalidates a package's cached full metadata with a single ETag request so an unchanged registry answers with304, and keeps using the cached copy once the registry confirms it is current, even when the metadata does not list a publish time for every version. Previously, pnpm downloaded that metadata again whenever the cached copy was older thanminimumReleaseAge. Packages listed inminimumReleaseAgeExcludealso resolve from cached metadata without a registry request when the lockfile already has the version their range picks.Linking node_modules and workspaces
ENOTEMPTYwhen its copy of the package collided with the copy another install had already placed [ENOTEMPTY race when concurrent installs import the same package into one node_modules/.pnpm pnpm/tasks#48](https://redirect.github.com/pnpm/tasks/issues/Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.